Extracted

• • Target

    efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

  • Size

    246KB

  • MD5

    2dade2e0c6d4d29ae58f4d62cbbeeee8

  • SHA1

    87432db4e77f0dce442e1cbe00faf86b8ace3f35

  • SHA256

    efcbeee1818c45b33e015b75583593fe4b70eda6c8a7de53d9c1bd3d165e9182

  • SHA512

    2d01a4dd3be434ddb3d19af314eaf708325c7ffcd4cce9a4f33ac8932a65292e59d41dc9cbd3ea6a377d9e3f3713574cb0ebc7d601df337bd520ce1e8c3d5cb2

  Score

  10^/10

  matiexcollectionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2